//
// Source code recreated from a .class file by IntelliJ IDEA
// (powered by Fernflower decompiler)
//

package net.mingsoft.basic.filter;

import cn.hutool.cache.CacheUtil;
import cn.hutool.cache.impl.TimedCache;
import cn.hutool.core.collection.CollectionUtil;
import cn.hutool.core.io.FastByteArrayOutputStream;
import cn.hutool.core.io.IoUtil;
import cn.hutool.json.JSONUtil;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.Iterator;
import java.util.List;
import java.util.Map;
import java.util.Map.Entry;
import javax.servlet.ReadListener;
import javax.servlet.ServletInputStream;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import net.mingsoft.base.exception.BusinessException;
import net.mingsoft.basic.util.BasicUtil;
import net.mingsoft.basic.util.JsoupUtil;
import org.apache.commons.lang3.StringUtils;

public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
    private HttpServletRequest request = null;
    private List<String> excludesFiled = new ArrayList();
    public static TimedCache<String, Integer> timedCache = CacheUtil.newTimedCache(86400000L);

    public XssHttpServletRequestWrapper(HttpServletRequest request) {
        super(request);
        this.request = request;
    }

    public XssHttpServletRequestWrapper(HttpServletRequest request, List<String> excludesFiled) {
        super(request);
        this.request = request;
        if (CollectionUtil.isNotEmpty(excludesFiled)) {
            this.excludesFiled.addAll(excludesFiled);
        }

    }

    private void xssCountAdd(String ip) {
        if (!timedCache.containsKey(ip)) {
            timedCache.put(ip, 1);
        } else {
            timedCache.put(ip, (Integer)timedCache.get(ip) + 1);
        }

    }

    public ServletInputStream getInputStream() throws IOException {
        FastByteArrayOutputStream read = IoUtil.read(this.request.getInputStream());
        String tmp = read.toString();
        if (JSONUtil.isTypeJSON(tmp)) {
            try {
                if (JSONUtil.isTypeJSONArray(tmp)) {
                    List<Map> jsonList = JSONUtil.toList(tmp, Map.class);
                    jsonList.forEach((map) -> {
                        Iterator iterator = map.keySet().iterator();

                        while(iterator.hasNext()) {
                            String key = iterator.next().toString();
                            JsoupUtil.cleanOrSqlInjection(key);
                            if (map.get(key) instanceof String && !this.excludesFiled.contains(key)) {
                                JsoupUtil.cleanOrSqlInjection(String.valueOf(map.get(key)));
                            }
                        }

                    });
                } else {
                    Map jsonMap = (Map)JSONUtil.toBean(tmp, Map.class);
                    Iterator iterator = jsonMap.keySet().iterator();

                    while(iterator.hasNext()) {
                        String key = iterator.next().toString();
                        JsoupUtil.cleanOrSqlInjection(key);
                        if (jsonMap.get(key) instanceof String && !this.excludesFiled.contains(key)) {
                            JsoupUtil.cleanOrSqlInjection(String.valueOf(jsonMap.get(key)));
                        }
                    }
                }
            } catch (BusinessException var6) {
                this.xssCountAdd(BasicUtil.getIp());
                throw new BusinessException(var6.getMsg());
            }
        }

        if (JsoupUtil.hasXSS(tmp)) {
            this.xssCountAdd(BasicUtil.getIp());
            throw new BusinessException("上传文件存在xss攻击");
        } else {
            return new XssHttpServletRequestWrapper.WrappedServletInputStream(new ByteArrayInputStream(read.toByteArray()));
        }
    }

    public String getParameter(String name) {
        String value = null;

        try {
            name = JsoupUtil.cleanOrSqlInjection(name);
            value = super.getParameter(name);
            if (StringUtils.isNotBlank(value) && !this.excludesFiled.contains(name)) {
                value = JsoupUtil.cleanOrSqlInjection(value);
            }

            return value;
        } catch (BusinessException var4) {
            this.xssCountAdd(BasicUtil.getIp());
            throw new BusinessException(var4.getMsg());
        }
    }

    public Map getParameterMap() {
        Map map = super.getParameterMap();
        Map<String, String> returnMap = new HashMap();
        Iterator entries = map.entrySet().iterator();
        String name = "";
        String value = "";

        while(entries.hasNext()) {
            Entry entry = (Entry)entries.next();
            name = (String)entry.getKey();
            Object valueObj = entry.getValue();
            if (null == valueObj) {
                value = "";
            } else if (!(valueObj instanceof String[])) {
                value = valueObj.toString();
            } else {
                String[] values = (String[])((String[])valueObj);

                for(int i = 0; i < values.length; ++i) {
                    value = values[i] + ",";
                }

                value = value.substring(0, value.length() - 1);
            }

            if (this.excludesFiled.contains(name)) {
                returnMap.put(name, value.trim());
            } else {
                try {
                    returnMap.put(JsoupUtil.cleanOrSqlInjection(name), JsoupUtil.cleanOrSqlInjection(value).trim());
                } catch (BusinessException var10) {
                    this.xssCountAdd(BasicUtil.getIp());
                    throw new BusinessException(var10.getMsg());
                }
            }
        }

        return returnMap;
    }

    public String[] getParameterValues(String name) {
        String[] arr = super.getParameterValues(name);
        if (arr != null) {
            for(int i = 0; i < arr.length; ++i) {
                if (!this.excludesFiled.contains(name)) {
                    try {
                        arr[i] = JsoupUtil.cleanOrSqlInjection(arr[i]);
                    } catch (BusinessException var5) {
                        this.xssCountAdd(BasicUtil.getIp());
                        throw new BusinessException(var5.getMsg());
                    }
                }
            }
        }

        return arr;
    }

    public String getHeader(String name) {
        String value = null;

        try {
            name = JsoupUtil.cleanOrSqlInjection(name);
            value = super.getHeader(name);
            if (StringUtils.isNotBlank(value) && !this.excludesFiled.contains(name)) {
                value = JsoupUtil.cleanOrSqlInjection(value);
            }

            return value;
        } catch (BusinessException var4) {
            this.xssCountAdd(BasicUtil.getIp());
            throw new BusinessException(var4.getMsg());
        }
    }

    public HttpServletRequest getRequest() {
        return this.request;
    }

    public static HttpServletRequest getOrgRequest(HttpServletRequest req) {
        return req instanceof XssHttpServletRequestWrapper ? ((XssHttpServletRequestWrapper)req).getRequest() : req;
    }

    private class WrappedServletInputStream extends ServletInputStream {
        private InputStream stream;

        public void setStream(InputStream stream) {
            this.stream = stream;
        }

        public WrappedServletInputStream(InputStream stream) {
            this.stream = stream;
        }

        public int read() throws IOException {
            return this.stream.read();
        }

        public boolean isFinished() {
            return true;
        }

        public boolean isReady() {
            return true;
        }

        public void setReadListener(ReadListener readListener) {
        }
    }
}
